According to the Microsoft SC-300: Identity and Access Administrator Study Guide and official Microsoft Learn content under "Manage Azure AD roles in Privileged Identity Management (PIM)", Azure AD Privileged Identity Management (PIM) allows organizations to assign eligible roles to users who need on- demand administrative access.
The official documentation specifies the following:
* User accounts (members of the tenant) can be added as eligible for Azure AD roles.
* Guest users (B2B collaboration users) can also be added as eligible for Azure AD roles, provided they exist in the Azure AD directory and are properly invited.
* Managed identities, however, cannot be assigned Azure AD directory roles. Managed identities are designed for service-to-service authentication within Azure resources and cannot perform administrative directory functions in Azure AD. They are used with Azure resources such as Virtual Machines, Logic Apps, or Azure Functions - not with Azure AD administrative roles.
From Microsoft documentation:
"Privileged Identity Management (PIM) supports user and guest accounts for eligible role assignment.
Managed identities cannot be assigned Azure AD directory roles."